Aetna Agrees to Pay Over $17 Million to Settle HIV Privacy Breach Class Action

Philadelphia -- A $17 million settlement was announced today in a federal class action lawsuit against Aetna, Inc., the third largest health insurance company in the United States, after a faulty mailing breached the HIV privacy of thousands of Aetna's customers.

The announcement by plaintiffs' attorneys comes six months after Aetna, as part of a settlement of an earlier set of lawsuits, mailed a notice in July 2017 in envelopes with large transparent windows that accidentally revealed that the recipients were prescribed HIV medications. It is believed to be the world's largest data breach involving HIV privacy, and many recipients have reported suffering significant harm as a result of the mailing.

Aetna envelope
One of the letters sent to Aetna clients in at least nine states
AIDS Law Project of Pennsylvania

The papers filed in support of the settlement allege that Aetna improperly transmitted to its legal counsel and a mail vendor the names of 13,487 customers who had been prescribed HIV medications and that large transparent window envelopes revealing confidential HIV-related information were sent to 11,875 of them.

Among those sent the mailing was "Andrew Beckett," a Pennsylvania resident who became the lead plaintiff in the nationwide class action lawsuit filed in August 2017 in the United States District Court for the Eastern District of Pennsylvania by the AIDS Law Project of Pennsylvania, the Legal Action Center, and Berger & Montague, P.C. The plaintiffs include people taking medication to treat HIV as well as those who, like Beckett, take PrEP, a pre-exposure prophylactic that prevents HIV.

Related: "Glaringly Obvious" Aetna Letter Exposed HIV Information of 12,000 People Through Envelope

The case arose in response to calls of alarm from people throughout the country who received the mailing or had heard about it. The lead plaintiff's pseudonym is that of the fictional lawyer with HIV portrayed by Tom Hanks in his Academy Award-winning role in the 1993 movie Philadelphia.

Under the terms of the proposed settlement, which is now subject to the Court's approval, Aetna has agreed to pay $17,161,200 to resolve the claims. All Settlement Class Members will automatically receive a Base Payment of either $75 to those whose protected health information was allegedly improperly disclosed by Aetna to its legal counsel and mail vendor, or at least $500 (inclusive of the $75 payment above) to those whose privacy was breached by the large-windowed envelope, whichever is applicable.

In addition, Settlement Class Members whose privacy was breached by the large-windowed envelope have the opportunity to seek additional monetary relief through the filing of a claim form documenting financial or non-financial harm.

The settlement also includes the implementation by Aetna of a new "best practices" policy to prevent similar incidents from occurring in the future, and provides for attorneys' fees and expenses.

The settlement agreement and motion for preliminary approval can be found here:

Beckett, the lead plaintiff, expressed satisfaction with the settlement. "HIV still has a negative stigma associated with it, and I am pleased that this encouraging agreement with Aetna shows that HIV-related information warrants special care," he said.

Ronda B. Goldfein, executive director of the Philadelphia-based AIDS Law Project of Pennsylvania, said that because stigma associated with HIV is still pervasive, some people who received the mailing were forced from their homes or suffered irreparable damages to relationships with friends, relatives, and neighbors. "The fear of losing control of HIV-related information and the resulting risk of discrimination are barriers to health care," Goldfein said. "This settlement reinforces the importance of keeping such information private, and we hope it reassures people living with HIV, or those on PrEP, that they do not have to choose between privacy and health care."

Sally Friedman, legal director of the New York City-based Legal Action Center, said "the settlement provides a fair and just way to compensate class members for their harm while also requiring practice changes to prevent future breaches. The settlement's magnitude will help restore the dignity and voice of those affected."

Shanon J. Carson, a managing shareholder of Berger & Montague, P.C., added that "not a day has gone by that I and my colleagues have not paused to think about the individuals and their families who have been affected by this breach, and we are glad that this settlement will bring closure and a remedy to this situation."

Torin A. Dorros, managing attorney of Dorros Law, which filed a subsequent lawsuit in California over the issue, called the outcome "a very significant resolution for all those affected and a landmark settlement in the area of protecting consumers' health information and privacy."

[Note from This article was originally published by Legal Action Center on Jan. 17, 2018. We have cross-posted it with their permission.]